Back to Intelligence

BeyondTrust Remote Support Under Active Attack: Edge Appliance Detection, Hunting, and Remediation Guide

SA
Security Arsenal Team
October 18, 2026
11 min read

This week delivered a familiar and deeply unwelcome pattern: BeyondTrust Remote Support has joined Ivanti, Cisco, and Palo Alto Networks in the crosshairs of attackers actively targeting edge and remote-access infrastructure. Reporting from Dark Reading confirms that an unpatched vulnerability in BeyondTrust Remote Support — the remote access platform deployed in thousands of enterprises for helpdesk and privileged session support — is being exploited in the wild.

If you've been in IR as long as I have, this playbook is burned into your memory: a remotely accessible appliance or gateway product, a vulnerability reachable from the network edge, rapid weaponization, and organizations discovering compromise weeks after initial access because the device sits outside their endpoint telemetry. Ivanti Connect Secure, Cisco ASA/IOS XE, Palo Alto PAN-OS, and now BeyondTrust Remote Support — the common thread is that edge infrastructure remains the highest-value initial access vector in modern intrusion campaigns.

This post breaks down what defenders need to know, how to hunt for post-exploitation activity on Remote Support infrastructure, and the concrete remediation steps your team should execute now.

Why This Matters: The Role Remote Support Plays in Your Environment

BeyondTrust Remote Support is not a peripheral tool. It is a privileged remote access platform used by service desks and administrators to take control of endpoints — including servers, domain-joined workstations, and in many environments, domain controllers. A compromise of the Remote Support server or appliance is not a foothold; it is a skeleton key.

An attacker who gains code execution on a Remote Support deployment can realistically:

  • Hijack or initiate legitimate remote sessions into managed endpoints, inheriting the access of any technician whose credentials or session tokens are exposed
  • Use the platform's built-in tooling (file transfer, command shell, registry access) to move laterally with traffic that looks indistinguishable from normal helpdesk activity
  • Harvest technician credentials, session recordings, and integration secrets (LDAP bind accounts, service accounts used for jump clients)
  • Deploy jump clients or persistence mechanisms to managed endpoints at scale

This is precisely why edge bugs in remote access platforms generate disproportionate blast radius compared to a typical server CVE. Treat any confirmed exploitation on a Remote Support server as a potential enterprise-wide incident, not a host-level event.

Technical Analysis

Affected Component

The vulnerability affects BeyondTrust Remote Support, the vendor's enterprise remote access product, deployed either as an on-premises appliance (virtual or hardware B Series) or self-hosted server, and in cloud-hosted configurations where the vendor manages the underlying platform. Organizations running self-hosted/on-premises deployments bear direct patch responsibility and are at the greatest risk of running an unpatched build.

How the Attack Works (Defender's Perspective)

Consistent with the edge-exploitation pattern seen against Ivanti, Cisco, and Palo Alto this week, the attack chain against Remote Support infrastructure follows a recognizable structure:

  1. External reconnaissance and fingerprinting — Remote Support portals present internet-facing login and session-initiation pages. Attackers enumerate exposed instances (Shodan/Censys reconnaissance commonly precedes these campaigns) and identify build versions from response fingerprints.
  2. Exploitation of the vulnerable component — the flaw is exploited against the network-facing web/application tier of the Remote Support server, yielding code execution in the context of the service account running the platform.
  3. Post-exploitation — typical observed behavior in this class of appliance compromise includes the web/application service spawning unexpected child processes (shells, downloaders, reconnaissance commands), outbound connections to attacker infrastructure, and — critically for Remote Support specifically — abuse of the platform's legitimate remote session capabilities to reach managed endpoints.

The exploitation is confirmed as active in the wild per current reporting — this is not a theoretical or PoC-only situation. Assume exposed, unpatched instances have been probed at minimum, and hunted at worst.

Exploitation Status

  • Active exploitation: Confirmed per Dark Reading reporting; part of a broader campaign wave against edge vendors the same week
  • Patch status: Vendor patch/mitigation guidance is available or imminent — verify against the BeyondTrust trust/advisory portal for your exact build
  • Internet exposure: Remote Support portals are frequently internet-reachable by design (that's the product's job), which means exposure is the default state, not a misconfiguration

Detection & Response

The single most reliable detection angle for appliance-class compromises like this is behavioral: the web or application service process doing things it never does in normal operation. Remote Support services do not spawn shells, run reconnaissance commands, stage archives, or initiate raw outbound connections to unfamiliar hosts. When they do, you have your signal.

Sigma Rules

YAML
---
title: BeyondTrust Remote Support Service Spawning Suspicious Child Process
id: 3f7a2c91-8b4d-4e2f-a1c6-9d5e7b0f3a21
status: experimental
description: Detects BeyondTrust Remote Support service processes spawning shells, scripting engines, or command interpreters — a strong indicator of post-exploitation activity following compromise of the Remote Support web/application tier.
references:
  - https://www.darkreading.com/endpoint-security/beyondtrust-remote-support-exploited-edge-bugs
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/02/11
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\bomgar'
      - '\beyondtrust'
      - 'sra.exe'
      - 'bomgar-scc'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
  condition: selection_parent and selection_child
falsepositives:
  - BeyondTrust scripted administration tasks; validate against change records
level: high
---
title: Shell Spawned by Remote Support Service on Linux Appliance
id: 8e1d4b62-5c3a-4f78-b2d9-1a6c8e0f4b37
status: experimental
description: Detects interactive shells or download utilities spawned by BeyondTrust Remote Support service processes on Linux-based appliances, consistent with post-exploitation command execution.
references:
  - https://www.darkreading.com/endpoint-security/beyondtrust-remote-support-exploited-edge-bugs
  - https://attack.mitre.org/techniques/T1059.004/
author: Security Arsenal
date: 2026/02/11
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'bomgar'
      - 'beyondtrust'
      - 'sra_'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Vendor update or diagnostics scripts executed during support sessions
level: high
---
title: Suspicious Network Connection from Remote Support Service Process
id: 5c9f3e17-2d6b-4a81-c3e4-7b0d9f2a5e18
status: experimental
description: Detects command shells or download tools spawned under the Remote Support service context initiating outbound network connections — indicative of C2 or payload retrieval following appliance compromise.
references:
  - https://www.darkreading.com/endpoint-security/beyondtrust-remote-support-exploited-edge-bugs
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/02/11
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\curl.exe'
      - '\certutil.exe'
    Initiated: 'true'
  filter_legit_ports:
    DestinationPort:
      - 443
      - 8200
  condition: selection and not filter_legit_ports
falsepositives:
  - Rare administrative tooling; investigate all hits given the active exploitation context
level: high

Microsoft Sentinel / Defender KQL Hunt

Use this query to hunt for suspicious child processes spawned by Remote Support services across managed Windows infrastructure, and correlate with outbound network activity:

KQL — Microsoft Sentinel / Defender
// Hunt: BeyondTrust Remote Support service spawning suspicious child processes
let suspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","certutil.exe","bitsadmin.exe","curl.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has_any ("sra", "bomgar")
   or InitiatingProcessFolderPath has_any ("bomgar", "beyondtrust")
| where FileName in~ (suspiciousChildren)
| extend ChildCmdline = ProcessCommandLine
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ChildCmdline, AccountName, RemoteIP, RemoteUrl
| order by TimeGenerated desc;

// Correlate: Remote Support infrastructure initiating unexpected outbound connections
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has_any ("sra", "bomgar", "cmd", "powershell", "curl", "certutil")
| where RemoteIPType == "Public"
| summarize ConnectionCount = count(), DistinctRemoteIPs = dcount(RemoteIP), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl, RemotePort
| where DistinctRemoteIPs >= 1
| order by LastSeen desc;

If you ingest appliance syslog via CEF into Sentinel, pivot on CommonSecurityLog for your Remote Support appliance source IPs talking to unfamiliar external destinations — appliances have a very stable egress baseline (vendor update servers, licensing, your managed endpoints), so deviations stand out.

Velociraptor VQL Hunt

For triage of a suspected Remote Support server, this artifact enumerates suspicious process lineage and unexpected listening/established connections:

VQL — Velociraptor
-- Hunt: Suspicious processes and connections on BeyondTrust Remote Support servers
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(cmd|powershell|pwsh|certutil|bitsadmin|curl|wget|mshta|rundll32)'
  AND (
    Exe =~ '(?i)(bomgar|beyondtrust|sra)'
    OR Username =~ '(?i)(bomgar|beyondtrust|sra|localservice|networkservice)'
  )
VQL — Velociraptor
-- Hunt: Unexpected established outbound connections from Remote Support host
SELECT Pid, Name, Status, Laddr, Lport, Raddr, Rport
FROM netstat()
WHERE Status =~ 'ESTABLISHED|LISTEN'
  AND Raddr !~ '(?i)^(127\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|$)'
  AND Rport != 443
ORDER BY Name

Tune the egress filter to your environment, but the principle holds: a Remote Support server has a small, predictable set of external destinations. Anything else during an active exploitation window deserves eyes.

Remediation

Execute these steps in order. Do not skip step 1 — patching a compromised box just gives you a compromised box on the latest version.

1. Hunt Before You Patch

Run the detections above against your Remote Support infrastructure and its managed endpoints for at minimum the last 14–30 days of telemetry. Look for: service-context child processes, unexpected egress, new local accounts on the server, and any remote sessions initiated outside of documented helpdesk activity or change windows. If you find indicators, invoke IR before patching — preserve memory and disk images of the Remote Support server.

2. Apply the Vendor Fix

  • Check the BeyondTrust advisories and trust portal for the specific patched build applicable to your deployment: https://www.beyondtrust.com/trust-center and the vendor security advisories page
  • Self-hosted/on-premises customers: schedule and apply the update immediately — this is an actively exploited internet-facing vulnerability and should be treated with CISA KEV-level urgency whether or not it has been formally cataloged yet
  • BeyondTrust cloud-hosted customers: confirm with BeyondTrust support that your instance has been remediated vendor-side, and request written confirmation of the patch timestamp for your change records

3. Verify and Harden

The following script verifies your Remote Support deployment state, checks service configuration, and collects the evidence baseline you need for both verification and ongoing hunting:

PowerShell
# BeyondTrust Remote Support — verification and hardening checks
# Run elevated on the Remote Support server (Windows deployments)

# 1. Identify installed Remote Support components and versions
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*,
    HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* |
    Where-Object { $_.DisplayName -match 'BeyondTrust|Bomgar' } |
    Select-Object DisplayName, DisplayVersion, InstallDate, Publisher |
    Format-List

# 2. Confirm Remote Support services and their run-as accounts
Get-CimInstance Win32_Service |
    Where-Object { $_.Name -match 'bomgar|sra|beyondtrust' -or $_.PathName -match 'bomgar|beyondtrust' } |
    Select-Object Name, State, StartName, PathName |
    Format-List

# 3. Inventory local accounts — flag anything created recently
Get-LocalUser |
    Select-Object Name, Enabled, PasswordLastSet, LastLogon |
    Sort-Object PasswordLastSet -Descending |
    Format-Table -AutoSize

# 4. Baseline outbound connections from Remote Support service processes
Get-NetTCPConnection -State Established |
    Where-Object { $_.RemoteAddress -notmatch '^(127\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)' } |
    ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        [PSCustomObject]@{
            Process    = $proc.ProcessName
            Path       = $proc.Path
            RemoteAddr = $_.RemoteAddress
            RemotePort = $_.RemotePort
        }
    } | Sort-Object Process -Unique | Format-Table -AutoSize

# 5. Audit recent Remote Support session activity for anomalies
# Export session logs from the /login administrative interface:
#   Management > Sessions > Export — review for sessions outside change windows,
#   unfamiliar source IPs, or sessions touching servers your helpdesk never administers.

# 6. Restrict management interface exposure
# The administrative (/login) interface should be reachable only from your
# management network or via VPN. Enforce at the firewall/load balancer:
#   - Deny public access to /login and /api paths
#   - Permit public access ONLY to the session-portal paths required for operation

4. Reduce Exposure Permanently

  • ACL the administrative interface to management networks only. There is no legitimate reason for /login to be internet-reachable
  • Enforce MFA on all technician and administrative accounts — credential theft against appliance admin interfaces is a standard follow-on in these campaigns
  • Rotate integration secrets (LDAP bind accounts, service accounts used by jump clients) if there is any possibility of pre-patch compromise
  • Egress filtering: Remote Support servers need a short allowlist of destinations. Deny-all-egress-except-required is cheap insurance that converts silent C2 into a noisy, blocked connection attempt
  • Ship appliance logs to your SIEM if you are not already — syslog from the Remote Support appliance into Sentinel/Splunk is table stakes

5. Validate

After patching, confirm the build number against the vendor advisory, re-run the hunt queries as a regression check, and document closure for your vulnerability management program. Given the current exploitation wave, also verify your other edge vendors (Ivanti, Cisco, Palo Alto) are at current patch levels — the same threat actors are cycling through these platforms.

The Bigger Lesson

Four major vendors' edge products exploited in a single week is not a coincidence; it is a campaign pattern. Edge and remote-access infrastructure is where the perimeter actually lives now, and it is chronically under-instrumented compared to endpoints. If your Remote Support server — or your VPN concentrator, or your firewall — is a black box with no telemetry flowing to your SOC, that is the gap to close before the next week like this one.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub

criticalzero-daycvepatch-tuesdayexploitvulnerability-disclosurebeyondtrustremote-supportedge-device-exploitationcommand-injection

Is your security operations ready?

Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.

Book a SOC AssessmentSee AlertMonitor in Action